Phishing is a scam where someone sends you a fake message pretending to be a sender you trust , your bank, a delivery company, your boss, or a well-known brand , to trick you into handing over a password, card number, or login code, or into opening a link or file that installs malware. It attacks the person, not the computer, by exploiting trust, fear, and urgency.
What Is Phishing?
Phishing is a social engineering attack: it tricks a person instead of breaking software. The attacker pretends to be a trusted name to get you to act:
- Who they impersonate: a bank, a courier, a tech company (Microsoft, Apple, Google), a government office, or someone you know.
- What they want: your passwords or login codes, your card or bank details, a payment, or to get malware onto your device.
- Why the name: it plays on “fishing” , the attacker casts out bait (a fake message) and waits for someone to bite by clicking, replying, or typing in details.
- Why it works: it targets human trust and urgency, so even careful people fall for it , which is why it is the leading cause of data breaches.
What Are the Main Types of Phishing?
Phishing comes in several types that differ mainly by the channel the scam arrives through and how targeted it is. The core trick , impersonating someone you trust , stays the same:
Email phishing
Spear phishing
Whaling
Smishing
Vishing
Quishing
A close relative is pharming, which quietly redirects a correct web address to a fake copycat site , no link to click. Whatever the channel, the defence is the same: slow down and verify before you act. Learning to recognise these is a core computer basics skill.
What Are the Red Flags of a Phishing Message?
Most phishing messages share a handful of warning signs , and spotting two or three together is almost a guarantee it is a scam:
- Urgency or threats: “Your account will be locked in 24 hours,” “Act now,” “Final notice.” Pressure to rush is the number-one tell , real companies give you time.
- A web address that does not match: hover over the link (do not click) and the real address differs from the text , lookalikes like
paypal-login.netormicros0ft.com(a zero for the o). - A generic greeting: “Dear Customer” or “Valued User” instead of your name , a real provider usually knows who you are.
- Requests for secret details: asking for your password, PIN, full card number, or a one-time code. Legitimate firms never ask for these by email or text.
- Unexpected attachments: invoices, “receipts,” or .zip and .html files you were not expecting , these can carry malware.
- Too good to be true: surprise prizes, refunds, inheritances, or crypto giveaways.
How Do You Spot and Handle a Suspicious Message?
When a message feels off, do not click anything , work through a short check first:
- Pause on urgency. The rush is the manipulation. A real account issue can wait the two minutes it takes to verify.
- Check the real sender. Look at the actual email address or phone number, not just the display name , a familiar name can hide a strange address.
- Hover the link (do not click). On a computer, hovering shows the true destination. Read the address from the right , the real domain is the part just before the first single slash.
- Never type a password from a message link. If it claims to be your bank or a service, open the official site yourself by typing the address or using your saved bookmark or app.
- Verify on a channel you trust. If “your bank” or “your boss” messages you, call back on a number you already have , not the one in the message.
- Report and delete. Mark it as phishing or junk, tell your IT team if it is a work account, then delete it. Do not reply.
How Common and Costly Is Phishing?
Phishing is the most common way attacks start, and the numbers are large:
- Leading entry point: phishing accounts for about 36% of all data breaches (Verizon DBIR) , more than any single software flaw.
- Massive scale: roughly 3.4 billion phishing emails go out every day (Symantec), so almost everyone is targeted eventually.
- AI raises the stakes (2026): AI-written phishing emails succeed about 54% of the time , roughly 4.5x human-written ones , and voice/video can be faked, so polish is no longer a safe signal.
How Do You Protect Yourself From Phishing?
You stop most phishing with a few simple habits, no technical skill needed:
- Do not click links or open attachments in unexpected messages. Go to the official site directly instead.
- Turn on two-factor authentication (2FA). Even if your password is stolen, the attacker still needs the second code , prefer an authenticator app or passkey over SMS.
- Use a password manager. It will not autofill on a lookalike site , a built-in warning that the address is wrong.
- Keep your browser, apps, and antivirus updated so known traps and malicious sites get blocked.
- Slow down on pressure and verify out-of-band , the single habit that defeats most attacks.
These beginner habits cover email, text, voice, and QR scams alike. The deeper technical defences below run mostly behind the scenes, but knowing they exist helps you trust a well-protected inbox a little more , without dropping your own guard.
Anatomy of a Phishing Email
A typical phishing email is built from a few standard parts designed to slip past both filters and your attention:
- Spoofed sender: the display name reads “PayPal Security,” but the real address is something like
security@paypa1.com, clients hide the real address by default. - Urgency or threat line: “Your account will be suspended in 24 hours” pushes you to act before you think.
- A disguised link: the text shows
www.paypal.comwhile the real destination ispaypa1.com/login, hovering reveals it. - A malicious attachment: macro-enabled Office files, booby-trapped PDFs, or .zip archives hiding an .exe.
- A fake landing page: a pixel-perfect copy of a real login. Anything you type is captured, then you are bounced to the real site so nothing seems wrong.
How Do Phishing Links Trick You?
Phishing links lean on a few tricks that make a bad web address look legitimate at a glance:
- Lookalike domains: swap a similar-looking character ,
paypa1.com(a 1 for the l),arnazon.com(rn for m),g00gle.com(zeros for o). - Homograph tricks: use a letter from another alphabet that looks identical , a Cyrillic “a” in
аpple.comreads as Apple but goes elsewhere (browsers now flag this with Punycode). - Subdomain spoofing: hide the brand as a subdomain ,
paypal.com.attacker-login.comis really owned byattacker-login.com; read right-to-left to catch it.
How Do You Verify a Link Before Clicking?
Before you click any link in a message, run this quick check:
- Hover to see the real URL. On desktop, hovering shows the true destination in the status bar , confirm the domain matches who it claims to be.
- Read the full domain right-to-left. In
paypal.com.login.ruthe real owner islogin.ru, not PayPal , the true domain is the part just before the first single slash. - Run it through a checker. Paste the link into VirusTotal, URLScan.io, or Google Safe Browsing before visiting , they sandbox the page and flag known-bad links.
- Go direct instead. If an email claims account activity, type the known address yourself or use your app , do not use the link in the message.
What Technical Defenses Stop Phishing?
Behind the scenes, email providers use authentication standards that block spoofed senders before they reach you:
- SPF (Sender Policy Framework): a published list of servers allowed to send mail for a domain , mail from anywhere else can be rejected.
- DKIM (DomainKeys Identified Mail): a cryptographic signature proving a message really came from the domain and was not altered in transit.
- DMARC: builds on SPF and DKIM to tell receivers what to do with fakes , monitor, send to spam, or block , and stops exact-domain spoofing.
- Anti-phishing filters: security gateways (Microsoft Defender, Proofpoint, Mimecast) scan links and attachments with machine learning, rewrite links to scan them on click, and open attachments in a sandbox first.
Comparison of Phishing Types
This table sums up how the main phishing types differ across channel, target, goal, and the defence that helps most:
| Type | Delivery Channel | Targeting | Primary Goal | Key Defense |
|---|---|---|---|---|
| Email phishing | Mass (untargeted) | Credential theft | SPF, DKIM, DMARC, anti-phishing filter | |
| Spear phishing | Specific individual | Credential theft, malware delivery | Security awareness training | |
| Whaling | Executives | Wire fraud, data theft | Multi-person authorization for transfers | |
| Smishing | SMS | Mass or targeted | Credential theft, malware install | Carrier filters, URL verification |
| Vishing | Voice call | Mass or targeted | Credential disclosure, OTP theft | Call-back verification, no OTP over phone |
| Pharming | DNS/hosts file | All site visitors | Credential theft at scale | DNSSEC, certificate validation, HTTPS |
Last Thoughts on What Is Phishing
Phishing works because it exploits human trust rather than a software flaw, which is why it stays the leading cause of data breaches no matter how good the technology gets. The types differ only by channel and target , the underlying move is always impersonating a sender you trust.
Technology (SPF, DKIM, DMARC, and anti-phishing filters) cuts the volume that ever reaches you, but your own habits close the gap , verify the link, confirm through a channel you already trust, and refuse to act on urgency. Slow down, and most phishing simply fails.
Key Takeaways:
- Phishing accounts for 36% of all data breaches (Verizon DBIR 2023).
- 3.4 billion phishing emails are sent daily (Symantec).
- The 6 phishing types are: email phishing, spear phishing, whaling, smishing, vishing, and pharming.
- Homograph attacks use visually identical Unicode characters to create convincing fake domains that differ at the code-point level.
- SPF, DKIM, and DMARC are the 3 email authentication standards that prevent domain spoofing at the protocol level.
- Always verify a link by hovering, reading the actual domain from right to left, and navigating via direct URL entry rather than clicking email links.
Frequently Asked Questions (FAQs)
What is the most common type of phishing attack?
Email phishing is the most common type, with 3.4 billion phishing emails sent daily (Symantec). It uses mass mailings that impersonate trusted brands to steal credentials or deliver malware via malicious links and attachments.
What is the difference between phishing and spear phishing?
Phishing is untargeted, sent to large numbers of recipients. Spear phishing is targeted at a specific individual or organization using personalized information. Spear phishing has a 19x higher click rate (Proofpoint 2023).
How can you tell if an email is phishing?
Check the actual sender email address (not just display name), hover over links to verify the real URL, look for urgency or threat language, and verify unexpected requests by contacting the sender through a known official channel.
What is pharming and how does it differ from phishing?
Pharming poisons DNS records or the local hosts file to redirect users from a correct URL to a malicious site. Unlike phishing, no deceptive link or email is required—the user types a legitimate URL and is silently redirected.
What are SPF, DKIM, and DMARC?
SPF lists authorized sending IPs for a domain. DKIM adds a cryptographic signature to verify message authenticity. DMARC specifies what to do when SPF or DKIM fails. All 3 work together to prevent email domain spoofing.
